diff --git a/apache2-ssl-global.conf b/apache2-ssl-global.conf
index 4ee1a02..4896cb7 100644
--- a/apache2-ssl-global.conf
+++ b/apache2-ssl-global.conf
@@ -77,8 +77,7 @@
 	#   SSL Cipher Suite:
 	#   List the ciphers that the client is permitted to negotiate.
 	#   See the mod_ssl documentation for a complete list.
-        #   https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy
-	SSLCipherSuite EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
+        SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
 
 	#   SSLHonorCipherOrder
 	#   If SSLHonorCipherOrder is disabled, then the client's preferences
diff --git a/apache2.changes b/apache2.changes
index 6ae8582..bfc8879 100644
--- a/apache2.changes
+++ b/apache2.changes
@@ -1,3 +1,12 @@
+-------------------------------------------------------------------
+Tue Aug 11 15:52:42 UTC 2015 - kstreitova@suse.com
+
+- fix Logjam vulnerability: change SSLCipherSuite cipherstring to 
+  disable export cipher suites and deploy Ephemeral Elliptic-Curve
+  Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to 
+  generate a strong and unique Diffie Hellman Group and append it
+  to the server certificate file [bnc#931723], [CVE-2015-4000] 
+
 -------------------------------------------------------------------
 Wed Jul 29 06:22:59 UTC 2015 - pgajdos@suse.com
 
diff --git a/gensslcert b/gensslcert
index 9f8916d..020f1ac 100644
--- a/gensslcert
+++ b/gensslcert
@@ -193,6 +193,9 @@ if [ $? -ne 0 ]; then
     myexit $LINENO $?
 fi
 
+echo;myecho generating dhparams and appending it to the server certificate file...
+openssl dhparam 2048  >> $sslcrtdir/${name}server.crt
+
 
 exit 0